Static task
static1
Behavioral task
behavioral1
Sample
e8d6b7d9409ee41cbc957c0cdf9868e3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e8d6b7d9409ee41cbc957c0cdf9868e3_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e8d6b7d9409ee41cbc957c0cdf9868e3_JaffaCakes118
-
Size
458KB
-
MD5
e8d6b7d9409ee41cbc957c0cdf9868e3
-
SHA1
9b0c3edec3f74dacc547240a8d3c0542f370eb51
-
SHA256
2ab4d9dcd77ff661381f655f786256f9e20bd66b253e2780db53e80d623791e5
-
SHA512
ddb448042047de89329fe24b14baed55791fd6e9d0f6eb831544c36ffdfa6c84e8e25a703051d0253d05c17b14a5a6ed0b10c4ef6732815dfae4171462f311a6
-
SSDEEP
12288:/aY7r2fjCsW7KapBKwqYrGqcfPt4I6Ndhcbs+g/P:/hmfj5MTKwqMGqgt4I6bhco+yP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8d6b7d9409ee41cbc957c0cdf9868e3_JaffaCakes118
Files
-
e8d6b7d9409ee41cbc957c0cdf9868e3_JaffaCakes118.exe windows:4 windows x86 arch:x86
0d5e3596b487246ec5e75a625e046ffd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GlobalUnlock
SetErrorMode
GlobalLock
GetModuleHandleW
LockResource
lstrcpyA
GetFileAttributesW
InterlockedIncrement
CreateEventW
InterlockedCompareExchange
ExpandEnvironmentStringsW
GetSystemDefaultUILanguage
EnterCriticalSection
GetCurrentThreadId
lstrlenW
GetVersionExA
SetLastError
FreeResource
DeleteFileW
FindResourceW
lstrlenA
GlobalReAlloc
GetCurrentProcess
GetFullPathNameW
CloseHandle
LeaveCriticalSection
CreateFileW
FindResourceA
GlobalAlloc
lstrcmpiW
TlsSetValue
LocalAlloc
GetDriveTypeW
GetShortPathNameW
SetCurrentDirectoryW
LoadLibraryA
MulDiv
GetACP
TlsGetValue
DeleteCriticalSection
FindNextFileW
GlobalFree
ResetEvent
FindFirstFileW
TerminateProcess
InitializeCriticalSectionAndSpinCount
lstrcmpW
CreateThread
GetLastError
FreeLibraryAndExitThread
SetEvent
QueryPerformanceCounter
SetUnhandledExceptionFilter
FreeLibrary
InterlockedDecrement
DisableThreadLibraryCalls
GetProcessVersion
UnhandledExceptionFilter
GetUserDefaultLCID
GetSystemTimeAsFileTime
InterlockedExchange
TlsFree
GetCurrentDirectoryW
DelayLoadFailureHook
GetProfileStringW
LocalReAlloc
GetVolumeInformationW
FindResourceExW
GetModuleFileNameW
MultiByteToWideChar
TlsAlloc
lstrcpynW
LoadResource
FormatMessageW
LocalSize
WideCharToMultiByte
lstrcpyW
GetProcAddress
LocalFree
GetTickCount
SizeofResource
GetLocaleInfoW
FindClose
GetTempFileNameW
LoadLibraryW
GetModuleHandleA
WaitForSingleObject
ntdll
_chkstk
wcslen
memmove
qsort
_wcsicmp
RtlInitUnicodeStringEx
NtQueryVirtualMemory
NtAllocateVirtualMemory
_vsnwprintf
RtlAnsiStringToUnicodeString
RtlUnwind
RtlIsNameLegalDOS8Dot3
mswsock
AcceptEx
GetAcceptExSockaddrs
ole32
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
dnsapi
DnsReplaceRecordSetW
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 283KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 968KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE